or run

npx @tessl/cli init
Log in

Version

Tile

Overview

Evals

Files

docs

apk-processing.mdbytecode-utilities.mdcli-tools.mddecompilation.mddex-analysis.mddynamic-analysis.mdindex.mdsession-management.mdstatic-analysis.mdutility-functions.mdxml-resources.md
tile.json

tessl/pypi-androguard

Comprehensive Python toolkit for Android application reverse engineering and security analysis.

Workspace
tessl
Visibility
Public
Created
Last updated
Describes
pypipkg:pypi/androguard@4.1.x

To install, run

npx @tessl/cli install tessl/pypi-androguard@4.1.0

index.mddocs/

Androguard

A comprehensive Python toolkit for Android application reverse engineering and security analysis. Androguard provides extensive capabilities for processing and analyzing various Android file formats including DEX/ODEX bytecode, APK packages, Android binary XML files, and Android resources.

Package Information

  • Package Name: androguard
  • Language: Python
  • Installation: pip install androguard
  • Python Requirements: Python >= 3.9
  • License: Apache License 2.0

Core Imports

import androguard

Common for APK analysis:

from androguard.core.apk import APK
from androguard.core.dex import DEX
from androguard.core.axml import AXMLPrinter, ARSCParser

For analysis and decompilation:

from androguard.core.analysis.analysis import Analysis
from androguard.decompiler.dad.decompile import DvClass, DvMethod

Session-based analysis:

from androguard.session import Session
from androguard.misc import AnalyzeAPK, AnalyzeDex

Basic Usage

from androguard.core.apk import APK
from androguard.misc import AnalyzeAPK

# Basic APK analysis
apk_path = "path/to/app.apk"
apk = APK(apk_path)

# Get basic APK information
print(f"Package name: {apk.get_package()}")
print(f"App name: {apk.get_app_name()}")
print(f"Version: {apk.get_androidversion_name()}")
print(f"Permissions: {apk.get_permissions()}")

# Complete analysis with DEX and decompilation
a, d, dx = AnalyzeAPK(apk_path)

# Access classes and methods
for cls in dx.get_classes():
    print(f"Class: {cls.name}")
    for method in cls.get_methods():
        print(f"  Method: {method.name}")

# Decompile a specific method
for cls in d:
    for method in cls.get_methods():
        if method.get_name() == "onCreate":
            print(method.get_source())

Architecture

Androguard follows a layered architecture enabling comprehensive Android reverse engineering:

  • Core Parsers: APK, DEX, AXML, and ARSC parsers handle Android file format processing
  • Analysis Layer: Static analysis engine providing control flow, call graphs, and method analysis
  • Decompiler: DAD (Dex to Android Decompiler) converts bytecode to readable Java-like source
  • Session Management: Persistent sessions for complex analysis workflows
  • CLI Tools: Command-line utilities for quick analysis tasks
  • Dynamic Analysis: Integration with Frida for runtime analysis and modification

This modular design enables both simple one-off analysis tasks and complex automated security research workflows.

Capabilities

APK Processing

Complete Android Package (APK) file analysis including manifest parsing, resource extraction, signature verification, permission analysis, and file structure inspection.

class APK:
    def __init__(self, filename: str, raw: bool = False, skip_analysis: bool = False, testzip: bool = False): ...
    def get_package(self) -> str: ...
    def get_app_name(self, locale=None) -> str: ...
    def get_androidversion_name(self) -> str: ...
    def get_permissions(self) -> list[str]: ...
    def get_activities(self) -> list[str]: ...
    def get_services(self) -> list[str]: ...
    def get_receivers(self) -> list[str]: ...
    def is_signed(self) -> bool: ...

APK Processing

DEX Analysis

Dalvik Executable (DEX) file parsing and bytecode analysis providing access to classes, methods, instructions, and control flow structures.

class DEX:
    def get_classes_names(self) -> list[str]: ...
    def get_class(self, name: str): ...
    def get_methods(self) -> list: ...
    def get_fields(self) -> list: ...

DEX Analysis

Android XML Processing

Binary Android XML (AXML) and Android Resource (ARSC) file processing for accessing application resources, layouts, and configuration data.

class AXMLPrinter:
    def __init__(self, raw_buff: bytes): ...
    def get_xml(self, pretty: bool = True) -> bytes: ...
    def is_valid(self) -> bool: ...

class ARSCParser:
    def __init__(self, raw_buff: bytes): ...
    def get_packages_names(self) -> list[str]: ...
    def get_string_resources(self, package_name: str, locale: str = '\x00\x00') -> bytes: ...

XML and Resources

Static Analysis

Advanced static analysis capabilities including control flow analysis, call graph generation, method analysis, and cross-reference detection.

class Analysis:
    def get_classes(self) -> list: ...
    def get_methods(self) -> list: ...
    def get_call_graph(self): ...
    def find_classes(self, class_name: str): ...
    def find_methods(self, class_name: str = ".*", method_name: str = ".*"): ...

Static Analysis

Decompilation

Java-like source code generation from Android bytecode using the DAD (Dex to Android Decompiler) engine.

class DvClass:
    def get_source(self) -> str: ...
    def get_methods(self): ...

class DvMethod:
    def get_source(self) -> str: ...
    def get_name(self) -> str: ...

Decompilation

Session Management

Persistent analysis sessions for complex workflows, enabling save/restore of analysis state and incremental processing.

class Session:
    def __init__(self): ...
    def add(self, filename: str, raw_data: bytes = None): ...
    def save(self, filename: str): ...
    def load(self, filename: str): ...

Session Management

Command Line Tools

Pre-built command-line utilities for common analysis tasks including APK inspection, DEX analysis, signature verification, and more.

def entry_point(): ...  # Main CLI entry point

Command Line Tools

Utility Functions

High-level utility functions for common analysis workflows, providing simplified interfaces for complex operations.

def AnalyzeAPK(filename: str, session=None, raw: bool = False): ...
def AnalyzeDex(filename: str, session=None, raw: bool = False): ...
def get_certificate_name_string(name, short: bool = False) -> str: ...

Utility Functions

Dynamic Analysis

Runtime analysis and modification capabilities using Frida integration for dynamic analysis, tracing, and runtime manipulation of Android applications.

class Pentest:
    def __init__(self): ...
    def connect_default_usb(self) -> bool: ...
    def attach_package(self, package_name: str, list_file_scripts: list, pid=None) -> bool: ...
    def start_trace(self, filename: str, session: Session, list_modules: list, list_packages: list = None) -> None: ...
    def dump(self, package_name: str) -> dict: ...

Dynamic Analysis

Bytecode Utilities

Advanced bytecode analysis and formatting utilities including visualization, export capabilities, and statistical analysis of Android bytecode.

def method2dot(mx: MethodAnalysis, colors: dict = None) -> str: ...
def method2png(filename: str, mx: MethodAnalysis, colors: dict = None) -> None: ...
def method2json(mx: MethodAnalysis, colors: dict = None) -> str: ...
def FormatClassToJava(class_name: str) -> str: ...
def get_package_class_name(class_name: str) -> tuple[str, str]: ...
def get_method_complexity(mx: MethodAnalysis) -> dict: ...

Bytecode Utilities

Common Types

# Analysis results tuple from AnalyzeAPK
AnalysisResult = tuple[APK, list[DEX], Analysis]

# Analysis results tuple from AnalyzeDex  
DexAnalysisResult = tuple[list[DEX], Analysis]

# Permission information
Permission = str

# Certificate information
Certificate = object

# Resource configuration
ResourceConfig = object

# Dynamic analysis types
MessageEvent = object
MessageSystem = object

# Advanced signature types
APKV2SignedData = object
APKV3SignedData = object
APKV2Signer = object
APKV3Signer = object

# Decompiler IR types
IRForm = object
Constant = object
Variable = object
BinaryOperation = object
AssignExpression = object
InvokeInstruction = object
FieldAccess = object

# Basic block types
BasicBlock = object
StatementBlock = object
ConditionalBlock = object
LoopBlock = object
TryBlock = object
ReturnBlock = object

# Method analysis type
MethodAnalysis = object